the temporarily stored data being monitored by the checking logic (1 1) in such a manner 
that, in the case of a fault, a safe state of the output unit (10) for the control process is 
initiated, 

the first transfer imit (5) monitoring the data sent out by the control unit (1), in such a 
manner that, in the case of a fault, release data for the peripheral safety-related imit (9) 
are suppressed or deleted so that the faulty data do not reach the control process, 
particularly data transmission sequences, wherein the input data of the peripheral safety- 
related unit (9) and its temporarily stored data are read back via the second transfer unit 
(6). 

2. The system as claimed in claim 1 , characterized in that the temporarily stored data and 
the input data of the peripheral safety-related unit (9) are provided to the peripheral 
monitoring unit (4). 

3. (Amended) The system as claimed in claim 1, characterized in that the peripheral safety- 

related unit (9) reads back the temporarily stored data via a bus unit (23). 

4. (Amended) The system as claimed in claim 1, characterized in that the peripheral safety- 

related unit (9) has a buffer (27) which is read back by a bus unit (23) and is thus checked 
by the peripheral monitoring unit (4) even before release to the control process, 
particularly of data transmitted via the bus, via the output logic (28) with the output 
signal (29). 

5. (Amended) The system as claimed in claim 3, characterized in that the peripheral safety- 

related unit (9) comprises a further bus unit (22) so that the peripheral safety-related unit 
(9) has redundant input channels (24, 25) and thus redundantly monitors the connected 
control process and can detect a fault. 
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6. (Amended) The system as claimed in claim 1, characterized in that the checking logic (11) 

decides whether the data stored in the buffer (27) are output via the output logic (28). 

7. (Amended) The system as claimed in claim 1, characterized in that the checking logic (11) 

releases or deletes the temporarily stored data. 

8. (Amended) The system as claimed in claim 1, characterized in that the peripheral monitoring 

unit (4) with the first transfer unit (5) is capable of manipulating the data for the 
peripheral safety-related unit (9). 

9. (Amended) The system as claimed in claim 1, characterized in that the peripheral monitoring 

unit (4) overwrites data of the SPC. 

10. (Amended) The system as claimed in claim 1, characterized in that the agreement to a 

data output from the peripheral safety-related unit (9) is prevented by the overwriting of 
the data. 

1 1 . (Amended) The system as claimed in claim 1, characterized in that the checking logic 

(1 1) receives from the peripheral monitoring unit (4) an information item which prevents 
a faulty output. 

12. (Amended) The system as claimed in claim 1, characterized in that the peripheral 

safety-related unit (9) only becomes active if it has received an agreement for the data of 
the output unit (10) via the checking unit (1 1). 

13. (Amended) The system as claimed in claim 1, characterized in that the peripheral units 

(4, 7, 8, 9, 12) themselves can perform logic operations and thus a higher process speed is 
achieved in the overall combined operation. 
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14. (Amended) The system as claimed in claim 1, characterized in that the peripheral 

monitoring unit (4) itself handles control functions and thus a combined operation with a 
safety control unit is produced. 

15. (Amended) The system as claimed in claim 1, characterized in that the peripheral 

safety-related unit (9) manages with standard non-safety-related modules for the bus 
traffic and does not need any special safety-related modules. 

16. (Amended) The system as claimed in claim 1, characterized in that the function is 

operable in standard bus systems and is capable of operating without additional 
installation of further bus systems or special components. 

17. (Amended) The system as claimed in claim 1, characterized in that the function can be 

installed subsequently by adding the peripheral monitoring unit (4) and exchanging 
normal peripheral units for peripheral safety-related units (9). 

18. (Amended) The system as claimed in claim 1, characterized in that the safety function 

of the system can also be subsequently expanded by adding hardware elements or 
software modules. 

19. The system for protected data transmission, particularly in ring-shaped bus systems, in 
which a peripheral monitoring unit (4) checks the data sent out by a control unit (1) and 
examines them for faults and in the case of a fault suppresses or deletes release data for a 
peripheral safety-related unit (9) so that a fauh cannot reach the control process, 
particularly not data transmission sequences. 

20. The system as claimed in claim 19, in which temporarily stored data of the peripheral 
safety-related unit (9) are read via a bus imit (23) and are monitored and detected by a 
checking logic (11). 
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21. (Amended) The system as claimed in claim 19, in which a safe state of data 

transmission, particularly of the output unit (10), is initiated by the checking logic (1 1). 

22. A peripheral safety-related unit in a system for protected data transmission in ring-shaped 
bus systems, comprising 

- two bus units (22, 23), to forward the output data of a bus unit (22) also to the input 
section of the other bus unit (23) in order to be able to fetch information jfrom the control 
process via redundant input channels (24, 25) and in order to provide the output data of a 
peripheral monitoring unit (4) for read-back, 

- a buffer (27) in which the output data are stored before their release, 

- an output logic (28) via which the temporarily stored data are output, and 

- a checking logic (11) which decides whether the data stored in the buffer (27) are output 
via the output logic (28). 

23. The peripheral safety-related unit as claimed in claim 20, characterized in that the 
checking logic (11) releases or deletes the temporarily stored data. 

24. (Amended) The peripheral safety-related unit as claimed in claim 22, characterized in 

that the checking logic (1 1) receives information from the peripheral monitoring unit (4) 
in order to be able to prevent a faulty output by this means. 
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